Desktop OIDC: non-blocking fetch + poll, don't leave webview

SPA fetches /oidc/open (returns session ID immediately), then polls
/oidc/result every 500ms. Go server opens browser in a goroutine.
Webview never leaves the Wails origin. Token is saved to keychain and
returned through the poll response.

web/src/pages/Config.svelte

@@ -72,11 +72,43 @@
     try {
       await startLogin()
     } catch (e: any) {
-      error = e.message || 'OIDC login failed'
+      const msg = e?.message || e || ''
+      if (msg.startsWith('DESKTOP_OIDC:')) {
+        const url = msg.substring('DESKTOP_OIDC:'.length)
+        await desktopOIDC(url)
+        return
+      }
+      error = msg || 'OIDC login failed'
       oidcLoggingIn = false
     }
   }
 
+  async function desktopOIDC(apiUrl: string) {
+    try {
+      const resp = await fetch(`http://127.0.0.1:18901/oidc/open?apiUrl=${encodeURIComponent(apiUrl)}`)
+      const { id } = await resp.json()
+      if (!id) throw new Error('No session ID')
+
+      for (let i = 0; i < 600; i++) {
+        await new Promise(r => setTimeout(r, 500))
+        const r = await fetch(`http://127.0.0.1:18901/oidc/result?id=${id}`)
+        const data = await r.json()
+        if (data.token) {
+          setConfig({ apiUrl, token: data.token, isDesktop: true })
+          initConfig({ apiUrl, token: data.token, isDesktop: true })
+          oidcLoggingIn = false
+          onConnected()
+          return
+        }
+        if (!data.pending || data.pending === 'false') break
+      }
+      error = 'Login timed out'
+    } catch (e: any) {
+      error = e?.message || 'Could not reach login service'
+    }
+    oidcLoggingIn = false
+  }
+
   function logoutOIDC() {
     oidcLogout()
     oidcUser = null